focalizahr-api

Name: focalizahr-api
Availability: InStock
Author: focalizahr

Enforce multi-tenant RBAC patterns across FocalizaHR API endpoints.

Updated Jun 7, 2025

Search Tags:#typescript #authorization #backend #rbac #api-security #prisma #multitenancy

Ready to run

npx skills add https://github.com/FOCALIZAHR/focalizahr-mvp --skill focalizahr-api

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: focalizahr-api
Source: https://github.com/FOCALIZAHR/focalizahr-mvp/tree/main/.claude/skills/focalizahr-api
Command: npx skills add https://github.com/FOCALIZAHR/focalizahr-mvp --skill focalizahr-api

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill provides standardized, security-first patterns for building FocalizaHR APIs, ensuring multi-tenant data isolation and consistent RBAC enforcement across endpoints.

Core Features & Use Cases

Centralized authorization: utilize extractUserContext, hasPermission, and getPermissionsForRole to guard resources.
Hierarchical and global access controls: support GLOBAL_ACCESS_ROLES for cross-tenant access and AREA_MANAGER-driven hierarchical filtering.
Safe API patterns: guidelines and anti-pattern references to prevent data leaks, misconfigurations, and insecure endpoints.

Quick Start

Configure a new API endpoint to extract the user context, enforce permissions, apply hierarchical access filters, and perform a multi-tenant safe database operation.

Frequently Asked Questions about focalizahr-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce multi-tenant RBAC patterns in a backend API?▼

Secure multi-tenant API endpoints by extracting user context, verifying permissions via hasPermission, and applying hierarchical filters. This ensures strict data isolation across all GET, POST, PUT, and DELETE operations.

How does hierarchical access filtering work for multi-tenant APIs?▼

Hierarchical access filtering uses getChildDepartmentIds and roles like AREA_MANAGER to scope query results dynamically. It restricts data visibility to authorized departments while allowing GLOBAL_ACCESS_ROLES for cross-tenant access.

What is the best way to prevent data leaks in multi-tenant API route handlers?▼

Prevent data leaks by applying accountId enforcement to all database queries and avoiding insecure endpoint configurations. Following established anti-pattern references ensures multi-tenant data isolation across all operations.

Can I use TypeScript and Prisma to implement secure API authorization patterns?▼

Yes, you can implement secure multi-tenant RBAC patterns using TypeScript and Prisma. The approach integrates authorization functions and access filters into backend services to ensure safe, paginated database operations.

Why does my multi-tenant API return data from unauthorized accounts?▼

Your API returns unauthorized data because accountId enforcement is missing from database queries. You must apply hierarchical access filters and use extractUserContext on every request to maintain strict tenant isolation.